MMA Digital ReaderLaunch Portal
REST API

Developer API Documentation

HTTP endpoints for mailbox automation. UUID-scoped, AES-256 encrypted sessions, documented rate limits.

GET /api/otp?uuid=...

Instant plaintext OTP code. Scans Inbox + Spam, returns the latest verification code as a plain string (empty if none found).

curl "https://api.ma-digital-reader.workers.dev/api/otp?uuid=YOUR_UUID"
# → 428836

GET /api/latest?format=json&uuid=...

Latest email metadata with parsed OTP: sender, subject, date, preview, body text, and extracted links.

GET /api/read_code?uuid=...&folder=all&limit=5
Inbox + Spam combined, capped at the 5 latest messages. Bodies are cleaned (HTML stripped, links preserved as Markdown). Optional include_html=true for raw HTML.
🔒 Security Model
  • Strict UUID-scoped isolation — every request requires a valid mailbox UUID
  • AES-256 encrypted session tokens (Fernet)
  • X-Admin-Key header required for /api/admin/*
⏱️ Rate Limits
  • 3s rapid-fire cooldown per mailbox UUID
  • 45 req/hour per mailbox (sliding window)
  • 200 req/min per IP ceiling
  • HTTP 429 JSON: MAILBOX_COOLDOWN_ACTIVE, MAILBOX_HOURLY_LIMIT_EXCEEDED
Recommended pattern: poll in a loop with 3–5 second sleeps.
🤖 Headless Automation
Open /inbox#latest in Puppeteer, Playwright, or Selenium and read the #latest-otp DOM selector for high-throughput client-side extraction.